Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have seen many write-ups on "malware research", what information are they trying to gather?

Is it the origins of the malware? Or its behavior patterns? Or something else?

share|improve this question
up vote 3 down vote accepted

Whodunit, what it does, what vulnerability it exploits, what it's communicating with (if anything), how it spreads, if it contains any useful forensic indicators etc etc.

Like watching a mutating biological virus and working out how it acts and how to develop a vaccine, the purpose of reverse engineering malware is to work out what it's doing and why.

There's a lot you can tell from such an analysis. What servers is it talking to, for example? This will pin down a compromised server at the minimum, and possibly a control server for a botnet at best. Knowing where the control server is might lead you to the individual or group responsible, or at least give you an idea.

Likewise, analysing the malware binary will possibly reveal previously unknown exploits. It'll also show you how malware authors are attempting to evade detection and what their goals are - for example, if the malware copies all word documents to a remote server, well, you now know they're after documents of some kind.

Origin can be given away. It's at least reasonably well known that Microsoft compilers embed program debug database paths in the output of the executable if you don't tell them not to; from the language used in said path you might be able to gather where the malware originated from, or even the intent. If the user who wrote it happened to develop it in c:\users\name\... well then you even know who they are!

In short, analysing malware is about finding out what you can about the infection - anything that might help identify the culprit, or further detection/prevention of future infections.

share|improve this answer
This book expands on it more, and how best to get the required info: – Savara May 12 '12 at 12:06

Short answer : find what it does (interactions with the infected system : files creation, keylogging, password stealing etc.).

This can be used to get a pattern used later by an AV product (malware signature). It can be used to trace back the author, too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.